Products | Versions |
---|---|
TIBCO LogLogic Enterprise Virtual Appliance | >=6.1.0 |
By default the GROUP BY function is case-sensitive.
For example, consider a data model, myTestModel, that obtains logs from various sources. The data model contains a property called payload. The payload property captures a string that is test in some logs and TEST in others. Using GROUP BY in an Advanced Search separates the uppercase and lowercase versions of the payload.
EQL:
use myTestModel | GROUP BY payload
SQL:
SELECT count(*) FROM myTestModel GROUP BY payload
In order to make the response for the SQL to match that given by EQL (i.e. to include the payload's value with its count) use
SELECT payload, count(*) FROM myTestModel GROUP BY payload
Each of the above will report the total number of logs with test or TEST entries separately. The second SQL query, like the EQL query, will list the number of entries of the payload against the payload's value:
# payload count
1 test 10
2 TEST 10
The separation of the two forms of 'test' may be desirable. However, it may not be.